# Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder Trick AI Coding Agents (Codex, Claude Code) Into Installing MALFEX npm Malware (function-color, function-flag)

> Forever Security reports that malicious agent instruction files (AGENTS.md / CLAUDE.md) sitting in a user's Downloads folder can make AI coding agents install known malware, including the MALFEX npm packages function-color and function-flag. Codex ran the malware in more than 90% of attempts and Claude Code in about half; the issue is design behavior, not a patchable vulnerability.

- **Published:** 2026-10-26T08:16:25Z
- **Last reviewed:** 2026-10-26T21:44:40.894Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4436
- **ID:** TL-2026-4436
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** MALFEX operator
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Forever Security documented a real attacker-authored AGENTS.md found on a customer's machine and reproduced the attack against OpenAI Codex and Anthropic Claude Code. The attack combines two individually harmless features: websites can save files into the Downloads folder without user interaction (the site chooses filename and contents), and coding agents read and follow instruction files in their working directory. A file named AGENTS.md or CLAUDE.md that masquerades as engineering documentation is therefore picked up whenever a user starts an agent in ~/Downloads.

Against Codex, the attacker's AGENTS.md was framed as routine project setup and told the agent to register a server in ~/.codex/config.toml and install an npm package. Per the report, Codex ran the malware in more than 90% of attempts. Because the config change lives in ~/.codex/config.toml, it affects every later Codex session, not only those started in Downloads. Against Claude Code, a planted CLAUDE.md posed as internal gateway setup and tried to write ANTHROPIC_BASE_URL into project settings (.claude/settings.json); this succeeded about half the time because of approval prompts. Redirecting the API endpoint can leak session login tokens, enabling account takeover and command injection from attacker-controlled servers. Forever Security built a proof-of-concept page that silently drops an AGENTS.md, but states it did not establish that this is how the observed file arrived. Forever Security's telemetry says roughly 50% of its customers run coding agents in Downloads and about 25% of agent sessions have a browser open at the same time.

The packages named in the instructions, function-color (wrapper that pulls in function-flag) and function-flag (postinstall downloader that fetches and runs a Windows PE payload), belong to the MALFEX npm campaign named by CloudSEK (2026-09-30) and Checkmarx (2026-10-05). MALFEX is attributed to a single operator active since August 2023 across five npm publisher handles; eight of twelve published packages are malicious, with 40,767 total downloads as of 2026-10-01 (function-flag alone 37,419, malicious since 2025-07-18). The campaign has three Windows payload paths: the Overlord Go RAT, which resolves its C2 address from Solana transaction memos and persists through an AutoIt scheduled task named Maiden; the movinlike Node.js stealer targeting Discord, browsers, Telegram and crypto wallets; and the function-flag downloader chain, whose final payload was not recovered because the server was unresponsive. As of late September 2026 function-flag, function-color and cdn-img-fetch were still installable and function-flag and function-color had no advisory. The sources do not establish who authored the malicious AGENTS.md or whether the file's author is the MALFEX operator; they only show the file points at MALFEX packages.

Vendors' position per the report: there is nothing for OpenAI or Anthropic to patch, since the agents function as designed and the weakness is the trust placed in untrusted instruction content. Severity (MEDIUM) and category (SUPPLY_CHAIN) are analyst judgment, not source-stated.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1059.005 Visual Basic
- AML.T0051.001 Indirect
- T1053.005 Scheduled Task
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1113 Screen Capture
- T1056.001 Keylogging
- T1567.004 Exfiltration Over Webhook
- T1204.002 User Execution
- T1562.001 Impair Defenses
- T1055.012 Process Injection
- T1134.004 Access Token Manipulation
- T1528 Steal Application Access Token
- T1557 Adversary-in-the-Middle
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1027.009 Obfuscated Files or Information: Embedded Payloads

## Sources

- [Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware](https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html)
- [CloudSEK: MALFEX malicious npm postinstall supply chain campaign](https://www.cloudsek.com/blog/malfex-malicious-npm-postinstall-supply-chain-campaign)
- [Checkmarx: MALFEX npm Malware Campaign - Three Payloads And An Adversary That Signs Their Work](https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/)
- [The Hacker News: Eight malicious npm packages downloaded](https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html)
- [MALFEX npm Campaign: 8 Packages Trigger Malware on Install and Require](https://lilting.ch/en/articles/malfex-npm-overlord-stealer)
- [Hackread: MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data](https://hackread.com/malfex-npm-windows-rat-steals-discord-browser-data/)
- [OSV advisory MAL-2026-17320 (cdn-img-fetch)](https://osv.dev/vulnerability/MAL-2026-17320)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4436